Treat every external frontend resource as untrusted until proven otherwise. This skill exists to stop the LLM from casually adding third-party scripts, embeds, fonts, or public credentials without a security review.

Non-Negotiables

Prefer self-hosting over browser-loading a third-party asset when practical.
If a CDN asset is loaded directly, it must be version-pinned and integrity-protected when the source supports it.
Secret keys never belong in the frontend bundle.
Frontend integrations must respect the project's CSP and embed policy.
External widgets and scripts are allowed only with explicit scope and review.

Forbidden behavior:

Do not add @latest or floating CDN references.
Do not embed server-side secrets or unrestricted credentials in browser code.
Do not use wildcard CSP or CORS settings as a shortcut for integration pain.
Do not add iframe or script permissions more broadly than the integration needs.
Do not normalize risky third-party code just because it is common or convenient.

kernel-asset-integration-security

Non-Negotiables

Threat Model